Cortex XSOAR Discussions

XSOAR HTML images

Hello,I would like to create an HTML template inside XSOAR (using a list) and adding a html image to it. I would like to know, if there is any local resource in where i can save the image and then import it in XSOAR, or it has to be done in a public url. For the other side, I would also like to know if it is possible to render an HTML inside a l...

Error with Uplaoding Files on wildfire Instance

Hey Community,we're encountering an issue with wildfire instance where the upload file command is throwing an error in the playbook . Please find the attachment for error snap .

Resolved! EWS O365 Instance - Not allowed to access Non IPM folder. (85)

XSOAR stopped fetching incidents from our assigned email address on April 3rd. I opened the EWS O365 instance to investigate and did a "test" for troubleshooting and the test result shows: Error (April 9, 2024 11:14 AM) Not allowed to access Non IPM folder. (85) We did not make any settings changes to the instance. After doing some research...

Splunk Add-on XSOAR Mapping

We fetch incident with Splunk Add-on. What should I do to enrich and map it? How can I run the mapper here? or do I need to proceed with setincident commands? #SplunkAddon Cortex XSOAR

Resolved! Select All in Data Collection multi select

Hi! We have a playbook which extracts indicators and adds it to a certain watchlist. In between, we allow user to select which indicators should be added by using Data Collection - Multi select / Array reply option. It is quite problematic slecting it manually when the selection is large, e.g. 100 entries. Is there a way to add a "Select all" ...

Cortex XDR multi-tenancy on XSOAR

Hello there, I am going to have cortex XDR multi-tenancy on one XSOAR. however I cant switch between cortex XDRs on XSOAR. I would be grateful if you could help me in this field. And another problem is that, the configuration of Cortex XDR-IOC, I took an error of unauthorized access, user doesnt have the required license type to run this API. ...

Resolved! Json data in table does not display in PDF reports

Json data in tables in xsoar does not show up when I try to export the table to a pdf report. I'm wondering if anyone else has had this issue or possibly has an alternative way to display this data in a report. (see attached screenshots) Thanks!

Fetching Microsoft Defender for Office 365 Alerts

Greetings! Has anyone had any success ingesting Microsoft Defender for Office 365 alerts into XSOAR? We're currently fetching MDE alerts using the Microsoft Defender for Endpoint integration. I'd think that, because they share a portal, MDO alerts would also be fetchable using this integration, but I haven't had any success. Microsoft's do...

XSOAR Playbook - Crowdstrike Endpoint Update

Hi All,i am new to XSOAR playbooks but i have managed to get a playbook operational that accepts data from a Microsoft form and then updates a crowdstrike endpoint's tag information (this end point is hard coded atm via its ID).The automation (cs-update-device-tags) will only accept the Crowdstrike ID. Its a unique 32 character value, which is o...

Resolved! Question from Playbook Optimization webinar: Delete context script

When should you use the "Delete context" script? Is it a good practice to use it at the beginning of the playbooks? ** Note: this is a question from our Customer Success Webinar: Playbook optimization in Cortex XSOAR Cortex XSOAR

EWS V2 Integration Issue

Hi Everyoen, I have XSOAR integration with EWS V2, few days ago its working fine but now suddenly got an issue please see the screenshot and provide valueable answers. Error (March 27, 2024 3:42 PM) Script failed to run: Docker code runner got container error: [Docker code script is in inconsistent state, expected pong but didn't got any r...

Resolved! Assign incident to new owner

I want to assign incident to new owner in xsoar , how to reassign tasks(pending as well as completed) automatically to the new owner

Sleep until 8.00AM the next day using SLA/timers

Hello, By using SLA/Timer on XSOAR, I want the playbook to wait until 08.00 the next day. how can I do that? I can use the sleep function, but I want to do it in the most performant way. Do you have any other suggestions? Thanks.

Xsoar Custome Widget

Hi, I am trying to create a custom widget that calculate follwing (Total Incident+ Total Command Execution) with date paramters adjusted by widget. I tried to implement this with JSON method and Automation Script but unable to get the solution. Can you suggest some solution and how this will be acheieved using automation script. Second questi...

extract SLRs or dumps xsoar

Greetings;Does anyone know or have created a method or know if using the Palo Alto API I can extract SLRs or download firewall dumps from XSOAR?thank you so much.

Discussions

XSOAR HTML images

Error with Uplaoding Files on wildfire Instance

Resolved! EWS O365 Instance - Not allowed to access Non IPM folder. (85)

Splunk Add-on XSOAR Mapping

Resolved! Select All in Data Collection multi select

Cortex XDR multi-tenancy on XSOAR

Resolved! Json data in table does not display in PDF reports

Fetching Microsoft Defender for Office 365 Alerts

XSOAR Playbook - Crowdstrike Endpoint Update

Resolved! Question from Playbook Optimization webinar: Delete context script

EWS V2 Integration Issue

Resolved! Assign incident to new owner

Sleep until 8.00AM the next day using SLA/timers

Xsoar Custome Widget

extract SLRs or dumps xsoar

I want to open the use case again

Indicator Extraction Refresh

XSOAR Dev to Prod - Builtin content repository

Still waiting on XSOAR Community Edition + Cortex XDR lab access

Result empty after using json2html script

Unlock your full community experience!

Resolved! EWS O365 Instance - Not allowed to access Non IPM folder. (85)

Resolved! Select All in Data Collection multi select

Resolved! Json data in table does not display in PDF reports

Resolved! Question from Playbook Optimization webinar: Delete context script

Resolved! Assign incident to new owner